Remote Code Execution in npm-groovy-lint · GHSA-qc22-qwm9-j8rx · GitHub Advisory Database · GitHub

Remote Code Execution in npm-groovy-lint

Critical severity GitHub Reviewed Published Dec 20, 2021 to the GitHub Advisory Database • Updated Jan 11, 2023

Package

npm-groovy-lint (npm)

Affected versions

< 9.1.0

Patched versions

9.1.0

Description

Versions of npm-groovy-lint prior to 9.1.0 bundle vulnerable versions of the Log4j library which are subject to remote code execution via jndi rendering. As a result npm-groovy-lint prior to 9.1.0 is also vulnerable.

References

Reviewed Dec 20, 2021

Published to the GitHub Advisory Database Dec 20, 2021

Last updated Jan 11, 2023